CVE-2026-107302 Details

A vulnerability in msgpack5, a MessagePack v5 implementation for Node.js and the browser, prior to version 6.1.0, allows for an out-of-bounds buffer read. This occurs because the decoder reads the four-byte length of a map32 value before ensuring that the complete five-byte header is available. As a result, a truncated map32 header leads to a checked out-of-bounds buffer read, causing a RangeError to be thrown instead of the expected IncompleteBufferError. This behavior can disrupt applications that rely on IncompleteBufferError to manage data streams, requests, or worker threads. Fortunately, the buffer implementation prevents adjacent memory disclosure by checking bounds.

Users can upgrade to msgpack5 version 6.1.0 or later, where this vulnerability has been fixed. In version 6.1.0, the decoder correctly validates the complete five-byte map32 header before reading its length, and properly handles truncated headers by throwing an IncompleteBufferError.